Nearly 23 million Internet Protocol addresses attached to devices such as networked printers, routers, IP cameras, media servers and smart TVs are exposed to Web-based attacks because of flaws in the UPnP (Universal Plug and Play) protocol of those devices, according to vulnerability testing firm Rapid7.
The plug and play protocol allows network devices to identify each other and establish working configuration for such things as data sharing, media playback and streaming and other services. For instance as file sharing gap in a computer can order a router to open a special port and map it into the computer’s local network address to facilitate file sharing to other users.
Three in four network devices insecure: survey
A guide to encrypting portable devices
The researchers also found that about a quarter of the UPnP were implemented using a library called Portable UPnP SDK, Eight remotely exploitable flaws have been identified with this specific library, said Rapid7.
The company said the vulnerabilities they had identified have been fixed, but it will take longer for application and device vendors to incorporate the patches into their products.
